Keep it running
Governance & Compliance Pack
The Governance & Compliance Pack is AI governance for financial services, healthcare, aesthetics and government in the UAE: an AI register, a risk assessment per system and PDPL mapping.
What it does
An AI register, a risk assessment per system, PDPL and sector mapping, audit-log design, an incident process, and DHA-compliant content checks.
For financial services, healthcare, aesthetics and government
- An AI register with a risk classification for every system
- Data-protection design to the UAE PDPL and the rules of your sector, with your advisers
- Testing for quality, bias and robustness, including prompt injection
- Policies, model documentation and an incident process
In the worked scenarios
Government & Public Services
A policy-bound agent, then the service control tower.
Financial Services & Insurance
Claims intake, then an AI register.
An AI register regulators can read
Before Models and vendors multiply across departments.
After Every AI system, its owner, tests and incidents, in one place.
How we engineer it
Evaluation.
Before we build, we build the test: an evaluation set drawn from your own cases, with pass thresholds your business owner agrees. Every release is scored for task success, groundedness, correct escalation, latency and cost per task. A change that lowers a score does not ship.
Security.
Untrusted content, whether an email, a web page or a customer message, is treated as data, never as instructions. We test for prompt injection before release and after every change. Secrets live in managed vaults, never in code or logs. Tenant and role isolation is enforced at the data layer, and every agent action is written to an audit log.
Human oversight.
Every agent says it is an AI. Handover is designed, not improvised: defined triggers pass a conversation to a named team with its full context. Actions with financial, legal or clinical weight wait for a person’s approval.
Questions a careful buyer asks
- Is this ready for a regulated business?
- We build to the Central Bank's AI guidance of February 2026, DoH and DHA policy and the UAE Personal Data Protection Law, with your advisers. Every system enters an AI register with its owner, tests and incidents.
- Where does our data live?
- In the UAE: in-country cloud regions, sovereign infrastructure or on your premises. Where it lives is written into the agreement before work begins, and we name every sub-processor.
In plain English
- PDPL
- The UAE Personal Data Protection Law, which sets rules for how personal data is collected, used and kept.
- prompt injection
- A trick where instructions planted in an email, web page or message try to make the AI do something it should not.
- evaluation set
- A collection of real examples with known right answers, used to score the AI before and after every change.
- groundedness
- Whether each answer is backed by the approved sources rather than made up.
- Tenant and role isolation
- Each organisation's data is kept separate, so one can never see another's.
- audit log
- A permanent record of every action the AI takes, with what, when and why, so it can be checked later.
- Human oversight
- People stay in control: the AI hands over to a person whenever it should.
Where it fits
The reason to choose Kwarix rather than a project: the people who built it stay to operate it.
Tell us about your business Talk to an engineer
Our AI consultant gathers the details and passes a report to one of our engineers, who replies by email, WhatsApp or phone.